hashicorp Shared library vulnerabilities

Latest hashicorp Shared library CVEs

Newest publication first

1. CVE-2026-19585 Go-getter vulnerable to a path traversal in S3/GCS directory download handling

   Published 2026-10-08

   Medium·CVSS 5.3 EPSS 0.21%

   HashiCorp go-getter versions before 1.8.10 and go-getter/v2 versions before 2.2.5 are vulnerable to path traversal during S3 and GCS directory downloads, which may allow files to be written outside the requested destination. This vulnerability (CVE-2026-19585) is fixed in go-gett...

2. CVE-2026-88922 Go-getter vulnerable to a privilege escalation issue in its archive decompression handling

   Published 2026-09-15

   Medium·CVSS 6.7 EPSS 0.11%

   The go-getter library up to versions 1.8.8 and 2.2.3 is vulnerable to a privilege escalation issue in its archive decompression handling that may allow a crafted archive to cause extracted files to be created with elevated permission bits. Where extraction is performed by a privi...

3. CVE-2026-14362 Denial of service via crafted push/pull gossip message in memberlist

   Published 2026-07-08

   Medium·CVSS 4.9 EPSS 0.25%

   HashiCorp memberlist before version 0.6.0 is vulnerable to a denial-of-service issue in its push/pull state handling that may allow an attacker with network access to the gossip port to exhaust memory on a receiving node and cause the process to terminate. This vulnerability (CVE...

4. CVE-2026-8052 Nomad's exec2 task driver vulnerable to arbitrary file read/write on client host through symlink attack

   Published 2026-05-12

   Medium·CVSS 6.0 EPSS 0.13%

   HashiCorp Nomad’s exec2 task driver prior to 0.1.2 is vulnerable to arbitrary file read and write on the client host as the Nomad process user through a symlink attack. This vulnerability (CVE-2026-8052) is fixed in version 0.1.2 of the exec2 task driver.

5. CVE-2026-0969 Arbitrary code execution in React server-side rendering of untrusted MDX content

   Published 2026-02-12

   High·CVSS 8.8 EPSS 0.64%

   The serialize function used to compile MDX in next-mdx-remote is vulnerable to arbitrary code execution due to insufficient sanitization of MDX content. This vulnerability, CVE-2026-0969, is fixed in next-mdx-remote 6.0.0.

6. CVE-2025-8959 HashiCorp go-getter Vulnerable to Arbitrary Read through Symlink Attack

   Published 2025-08-15

   High·CVSS 7.5 EPSS 0.60%

   HashiCorp's go-getter library subdirectory download feature is vulnerable to symlink attacks leading to unauthorized read access beyond the designated directory boundaries. This vulnerability, identified as CVE-2025-8959, is fixed in go-getter 1.7.9.

7. CVE-2025-0377 HashiCorp go-slug Vulnerable to Zip Slip Attack

   Published 2025-01-21

   Critical·CVSS 9.1 EPSS 0.68%

   HashiCorp’s go-slug library is vulnerable to a zip-slip style attack when a non-existing user-provided path is extracted from the tar entry.

8. CVE-2024-6257 HashiCorp go-getter Vulnerable to Code Execution On Git Update Via Git Config Manipulation

   Published 2024-06-25

   High·CVSS 8.8 EPSS 0.98%

   HashiCorp’s go-getter library can be coerced into executing Git update on an existing maliciously modified Git Configuration, potentially leading to arbitrary code execution.

9. CVE-2024-6104 go-retryablehttp can leak basic auth credentials to log files

   Published 2024-06-24

   Medium·CVSS 5.5 EPSS 0.36%

   go-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file. This could lead to go-retryablehttp writing sensitive HTTP basic auth credentials to its log file. This vulnerability, CVE-2024-6104, was fixed in go-retryablehttp 0.7.7.

10. CVE-2024-3817 HashiCorp go-getter Vulnerable to Argument Injection When Fetching Remote Default Git Branches

    Published 2024-04-17

    Critical·CVSS 9.8 EPSS 1.3%

    HashiCorp’s go-getter library is vulnerable to argument injection when executing Git to discover remote branches. This vulnerability does not affect the go-getter/v2 branch and package.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.